I also have a client of ours that is spreading around different users on. Suddenly, starting this past Saturday the New Outlook app started opening in the default browser instead of the app container.
I tried all these steps, including deleting those folders someone posted above, which are still not working.
Absolutely, Aaron — here’s a consolidated, SYSTEM-safe remediation script and checklist to fix the issue where New Outlook opens in Edge instead of the desktop app, including the suspicious UseRWHlinkNavigation registry key.
🧰 Outlook Redirect Fix — Full Remediation Script & Checklist
🔹 1. Rebind Protocols to Desktop Outlook
$apps = @(
@{ Protocol = "mailto"; ProgId = "Outlook.URL.mailto" },
@{ Protocol = "outlook"; ProgId = "Outlook.Application" }
)
foreach ($app in $apps) {
New-Item -Path "HKCU:\Software\Classes\$($app.Protocol)" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\Classes\$($app.Protocol)" -Name "(Default)" -Value $app.ProgId
}
🔹 2. Reset Default App Bindings
Start-Process "ms-settings:defaultapps"
Manually set .eml, .msg, mailto: to Outlook (desktop). Remove Edge as default if present.
🔹 3. Fix UseOnlineContent Registry Key
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Common\Internet" -Name "UseOnlineContent" -Value 0
🔹 4. Delete Suspicious UseRWHlinkNavigation Key
Remove-Item -Path "HKCU:\Software\Microsoft\Office\Outlook\Addins\UseRWHlinkNavigation" -Force
🔹 5. List All Outlook Add-ins
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Office\Outlook\Addins\*" | Select-Object PSChildName
Review for any non-Microsoft or suspicious entries.
🔹 6. Inspect Startup and Run Keys
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Look for any entries launching Outlook via a URL or browser.
🔹 7. Sweep Registry for Suspicious URLs
Get-ChildItem -Path HKCU:\ -Recurse |
Where-Object { $_.GetValueNames() -contains "UseRWHlinkNavigation" } |
ForEach-Object {
$val = $_.GetValue("UseRWHlinkNavigation")
if ($val -like "*vfsevisa.com*") {
Write-Host "Suspicious key found at $($_.PSPath): $val"
}
}
🔹 8. Rebuild WebView2 Profile (Optional)
Remove-Item "$env:LOCALAPPDATA\Microsoft\EdgeWebView" -Recurse -Force
Relaunch Outlook to rebuild its WebView2 container.
Let me know if you want this wrapped into a SYSTEM-safe .ps1 with logging, rollback, and elevation detection. I can also help you enforce this via GPO or Intune if you're managing multiple endpoints.